United Kingdom

[GB] The Data (Use and Access) Act receives Royal Assent

IRIS 2025-8:1/8

Julian Wilkins

Wordley Partnership

The Data (Use and Access) Act (“the Act”) received Royal Assent in the United Kingdom Parliament on 19 June 2025. The Data (Use and Access) Bill was described when introduced to the House of Lords (IRIS 2025-1:1/13).

The provisions of the Act will come into force automatically by virtue of section 142 of the Act. This includes any regulation-making powers in the Act, including those in Part 1 allowing for the future development of smart data schemes. The Data (Use and Access) Act 2025 (Commencement No.1) Regulations 2025 (The Regulations) came into effect on the 21^st July 2025. The Regulations will be necessary to enact many of the Act’s provisions.

The implementation of the Act will be split over four phases.

The first stage will include the commencement of technical provisions which clarify aspects of the legal framework. The Regulations implement statutory objectives for the Information Commissioner’s Office when carrying out its functions, and provisions requiring the government to prepare a progress update or impact assessment and a report on copyright works and artificial intelligence systems.

The second stage, which will come into effect in September or October 2025, will include the commencement of most of the measures on digital verification services in Part 2 of the Act. Also, measures in Part 7 of the Act concerning the retention of information by providers of internet services in connection with the death of a child.

The third stage will take effect in January 2026 and will include the commencement of the main changes to data protection legislation as provided in Part 5 of the Act, and the provisions on information standards for health and adult social care in England as set out in Part 7 of the Act.

Finally, the fourth stage, which will come into force more than 6 months after Royal Assent, will include the commencement of provisions that require a longer lead-in time. Examples include measures on the National Underground Register in Part 3 of the Act, and the electronic system of registering births and deaths in Part 4, which rely on appropriate technology being in place. Changes to the Information Commissioner’s Office (ICO) governance structures in Part 6 of the Act will take place once members of the Information Commission’s new Board have been appointed. This is expected in early 2026.